OWASP Automated Threat (OAT– 006) Expediting

Expediting – Perform actions to hasten the progress of usually slow, tedious or time-consuming operations.

What is Expediting?

Using speed to violate explicit or implicit assumptions about the application’s normal use to achieve unfair individual gain, often associated with deceit and loss to some other party.

In contrast to OAT-016 Skewing which affects metrics, Expediting is purely related to faster progression through a series of application processes. OAT-017 Spamming is different to Expediting, since the focus of spam is to add information, and may not involve the concept of process progression.

Expediting is also known by the terms such as algorithmic trading, automated stock trading, betting automation, game automation, gaming bot, gold farming, financial instrument dealing, high-frequency trading, last look trade, mining, purchase automation, trading automation, ticketing automation, virtual wealth generation bot.

The Symptoms of Expediting

OWASP, the worldwide not-for-profit charitable organization focused on improving the security of software, notes a possible symptom of expediting. This include,

1. Uncharacteristically fast progress through multi-stage processes

Sectors Targeted by Expediting

Expediting attempts are aimed at a variety of sectors including entertainment, financial, retail, government and social networking industries.

OWASP, the worldwide not-for-profit charitable organization focused on improving the security of software, says expediting involves performing actions to fasten the progress of slow, tedious and time-consuming actions.

Ways to Prevent Expediting Security Threat

OWASP suggests several possible countermeasures to address the threat of expediting. These include,

1. An organization can accurately identify and restrict automated usage by fingerprinting the user agent for its unique characteristics and other data points to block bad bots.


2. OWASP also recommends organizations to participate in ecommerce threat intelligence exchanges and contributing any relevant attack data to sector-wide sharing systems.

These are the primary security checks against expediting attempts, but dedicated fraudsters will go beyond the lengths to straighten their expediting effort often operating through privacy browsers, VPN, proxy servers to blur their online identity. Above mentioned are the few security measures that help fight back against malicious users, without causing harm to your legitimate users.

Online businesses can also opt for a bot mitigation solution that prevents expediting attempts and other OWASP automated threats in real-time without affecting any legitimate visitors. Bot mitigation is probably the most accurate solution for preventing OWASP Automated Threats and also ensure real-time protection against malicious bots. Bot mitigation solution can block all automated ways to expedite actions on websites by bots.

By deploying these methods, you build a more robust defence against expediting attempts and other malicious security threats.